This guide explains where the data you manage in Dhalinta AI Automation is stored, what is encrypted and what happens to the messages of each channel. We only describe what the platform does today.
Where your data is stored
Conversations from all your channels (WhatsApp, Instagram, Messenger, Telegram, website chatbot and email), your contacts, appointments and tickets are stored on our servers in the European Union: the main one, hosted by Contabo GmbH in Germany, and a replica in Spain.
Photos, audio, videos and documents arriving through WhatsApp, Instagram, Messenger and Telegram, and ticket attachments, are downloaded to those same servers. They don’t depend on Meta’s link staying available.
What is encrypted
- Message text: what your customers write and what your team and the AI reply is stored encrypted with AES-256, using its own key, separate from the application’s. So are the AI’s draft replies in email.
- Tickets, appointments and calls: ticket subjects, descriptions and replies, appointment notes and cancellation reasons, and call transcripts. They can still be searched by whole words, using the same fingerprint technique as conversations.
- What the AI and your team produce from the conversation: the alerts you receive, the summaries the AI keeps, the logs of the actions it takes (booking, creating a ticket…) and the data sent to your automations. Tasks waiting in the processing queue are encrypted too, including those that fail and are kept to be retried.
- Technical copy of each incoming message: when Meta or Telegram deliver a message, we keep a copy exactly as it arrives so we can retry if something fails. That copy is encrypted too and is deleted after 14 days.
- Attachments: photos, audio, videos and documents are stored encrypted with AES-256, using Dhalinta AI Automation’s own keys, separate from the application’s. Anyone copying the disk would only see unreadable files. In the dashboard they open as usual.
- Credentials: your channel tokens, mailbox passwords and integration keys are stored encrypted and never shown in the dashboard.
- Connections: everything travels encrypted (HTTPS/TLS), between your browser and the platform and between the platform and the services it uses.
The journey of a message
The same in every messaging channel (WhatsApp, Instagram, Messenger, Telegram and website chatbot):
- It travels encrypted. From the channel to our servers the message travels over HTTPS. For WhatsApp, Instagram and Messenger we also check Meta’s signature before accepting it.
- It is stored encrypted. The message text and files are stored encrypted, and so is the technical copy when the message is delivered by Meta or Telegram. So that search works without decrypting conversations, only a fingerprint of each word is stored, which cannot be turned back into the word.
- The AI reads it to reply. The text is decrypted only in memory, sent to the AI model in Europe over an encrypted connection, and the reply is stored encrypted.
- Your team sees it in the dashboard. It is decrypted on the spot, only for people signed in with permission to see it.
- Backups keep it encrypted. What is encrypted in the database stays encrypted in the backups and the replica.
In the Email channel the text is encrypted the same way, and attachments stay in your mailbox (explained below).
What is stored without encryption
Contact details (name, phone, email), what is noted in the contact record, and operational data (dates, channel, conversation or ticket status, pipeline stage) are not encrypted field by field, because they are used to search, send messages and organise work. They are on the same EU servers, with restricted access, and always travel encrypted.
Backups
The database is backed up every day; each copy is kept for 60 days and then deleted automatically. There is also a replica of the database and files at the premises of Screen Art S.L.U., our EU representative, in Mallorca (Spain). Everything travels over encrypted channels and stays within the European Union; message text, attachments and credentials remain encrypted in the copies too.
Email: your mailbox remains the source
For the Email channel we store only the text of the messages, encrypted, and the thread details. Attachments are not copied to our servers: they are downloaded from your mailbox when someone opens them.
How long files are kept
Channel files are kept for the period you configure (90 days by default) and are then deleted automatically.
Who else is involved
- Meta (Ireland) delivers and receives WhatsApp, Instagram and Messenger messages, and Telegram those of its channel: that is how those channels work, which is why they also see the content.
- The AI models that write the replies run in European data centres.
- The full list, with country and purpose, is on Subprocessors.
Your customers’ rights
Your customers receive the privacy notice inside the conversation and can request a copy of their data or its deletion from the same chat, as the GDPR provides.
GDPR
The GDPR requires security measures appropriate to the risk (Article 32). Keeping data in the EU, encrypting messages, files and credentials and limiting how long they are kept are part of those measures, and give you and your customers peace of mind. The full terms are in the data processing agreement.